Choigyeongmin

**Name of the Vulnerable Software and Affected Versions** ProSolution WP Client versions prior to 2.0.9 **Description** Insufficient file path validation in the `proSol fileDeleteProcess()` function allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as `wp-config.php`, are removed. Exploitation involves a two-step process: first, calling the `proSol fileUploadModalProcess` handler to poison the session with a path-traversal key, and second, calling `proSol fileDeleteProcess()` using that key as the `filename` parameter. Both actions require a publicly exposed frontend nonce. **Recommendations** Update ProSolution WP Client to version 2.0.9 or later. As a temporary mitigation, restrict access to the `proSol fileDeleteProcess()` function.

**Name of the Vulnerable Software and Affected Versions** bLoyal: Loyalty & Promotions by bLoyal versions prior to 3.1.611.79 **Description** This issue allows authenticated users with Subscriber-level access or higher to escalate their privileges to any WordPress user, including the site Administrator. The flaw exists because the AJAX actions `save bloyal configuration data` and `save bloyal accesskeyverification data` are registered without capability or nonce checks. An attacker can use these actions to overwrite the `bloyal custom loyaltyengine api url` and the `is bloyal custom api url` flag. Subsequently, by triggering the unauthenticated `/cart` REST route, the `bloyal customer auto login()` function fetches customer data from an attacker-controlled endpoint and uses the `Customer.ExternalId` value to call `wp set auth cookie()`, granting the attacker unauthorized authentication. **Recommendations** Update the plugin to a version newer than 3.1.611.78. As a temporary mitigation, restrict access to the `save bloyal configuration data` and `save bloyal accesskeyverification data` AJAX actions.

**Name of the Vulnerable Software and Affected Versions** GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more versions prior to 1.12.3 **Description** Insufficient file type validation in the `save video file()` function, which is hooked into the public `wpforms process before filter`, allows unauthenticated attackers to upload arbitrary files to the server. The issue occurs because the function trusts the attacker-supplied multipart Content-Type header, preserves the original filename using `wp unique filename()`, and moves the raw upload via `$wp filesystem->move()` into a web-served directory, thereby bypassing the MIME and extension allowlist of `wp handle upload()`. This flaw may enable remote code execution. **Recommendations** Update the plugin to a version later than 1.12.2. As a temporary workaround, restrict access to the `save video file()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Easy Form Builder by WhiteStudio versions prior to 4.0.12 **Description** An unauthenticated privilege escalation allows attackers to gain administrator access. The issue stems from the password recovery flow using a publicly-visible session identifier `sid` as the password reset token stored in `wp emsfb temp links`. This is combined with a publicly-accessible nonce refresh endpoint 'Emsfb/v1/nonce/refresh' that provides valid WordPress REST nonces to unauthenticated visitors. An attacker can scrape the `sid` from a published login form page, submit a recovery request for a known user email via the 'Emsfb/v1/forms/message/add' endpoint, and then use the 'Emsfb/v1/forms/recovery/efb set password' endpoint with the `sid` to set a new password. **Recommendations** Update Easy Form Builder by WhiteStudio to version 4.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin versions prior to 1.2.0 **Description** The plugin is subject to a generic SQL Injection, a flaw where an attacker can interfere with the queries that an application makes to its database. This occurs due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. An attacker can append additional SQL queries to extract sensitive information from the database. While the flaw is technically accessible to unauthenticated users, exploitation requires a valid `get-smart-reply` nonce. Since any user with Subscriber-level privileges can obtain this nonce by creating a ticket and visiting the ticket detail page, the issue is effectively exploitable by any authenticated user via the `val` parameter. **Recommendations** Update the plugin to a version newer than 1.1.9. As a temporary mitigation, restrict access to the functionality utilizing the `val` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Simple Coherent Form versions prior to 2.4.14 **Description** Insufficient file path validation in the `removeUploadDir()` function allows unauthenticated attackers to delete arbitrary files on the server. This can lead to remote code execution if critical files, such as `wp-config.php`, are deleted. The issue is facilitated by the 'scf get id upload' endpoint, which provides a valid `scf upload file removal` nonce to unauthenticated visitors. Additionally, the secondary hash check in the removal endpoint is forgeable offline because it uses a hardcoded salt embedded in the plugin source, failing to provide a secure authorization boundary. **Recommendations** Update Simple Coherent Form to version 2.4.14 or later.

**Name of the Vulnerable Software and Affected Versions** AR for WooCommerce versions prior to 8.41 **Description** The plugin is subject to Directory Traversal, allowing unauthenticated attackers to read arbitrary files on the server that may contain sensitive information. This is possible via the `file` parameter. The issue stems from the failure of three access controls: valid nonces are generated for unauthenticated users through the `ar get fresh nonce` and `ar process user image` AJAX handlers; the AES-256-CBC encryption key is predictable on default free installations because it is derived from `get option('ar licence key')`, which returns false; and the Referer header check is easily bypassed as it is controlled by the attacker. **Recommendations** Update to a version newer than 8.40. As a temporary mitigation, restrict access to the `file` parameter to prevent unauthorized file reads.

**Name of the Vulnerable Software and Affected Versions** AR for WordPress versions prior to 8.41 **Description** An unauthenticated directory traversal flaw exists in the file handling logic of the plugin. The issue occurs when the public AJAX functionality accepts a user-controlled `file` parameter without proper input validation or path sanitization, allowing traversal sequences to escape intended directories and read arbitrary server-side files. This can expose sensitive data such as database credentials in wp-config.php and API keys. To exploit this, an attacker must obtain a valid nonce and secure nonce via the `ar get fresh nonce` and `ar process user image` nopriv AJAX handlers and reproduce the encryption key locally, which is possible on default free or unlicensed installations where `ar licence key` is unset. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kirki versions 6.0.0 through 6.0.6 **Description** The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress contains a flaw allowing unauthenticated privilege escalation and account takeover. The issue occurs because the plugin accepts an arbitrary email address when a username is provided in a password reset request, enabling attackers to send a password reset link for any registered user, including administrators, to an email address they control. This is achieved through the `handle forgot password()` function at the forgot-password endpoint. Approximately 150,000 sites are estimated to be exposed, and the issue is being actively exploited in the wild. **Recommendations** Update to version 6.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Quiz Maker by AYS versions prior to 6.7.1.30 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the `rate reason` parameter, enabling the injection of arbitrary web scripts that execute when a user accesses an affected page. **Recommendations** Update to version 6.7.1.30 or later. As a temporary workaround, restrict or disable the use of the `rate reason` parameter.